I have data like
whrchan-ros,FirstName,LastName,End User,Activated,Major Account,Group,Direct sales
I want to create a Company field at search time, which is the 3 character suffix. I have a field transform, which is
but I also want to convert any suffixes that are ros, to be rhk, so I have an eval calculated field of
If I use eval in the search command it works, but it's not working via the calculated field definition, so I guess it's an order issue.
How can I make that substitution after the Company has first been extracted.
Calculated fields happen after field extractions (EXTRACT-aaa, REPORT-aaa). In your props.conf file enter the following and check again:
EXTRACT-company = .*-(?<Company>[a-z]*$)
EVAL-Company = if(Company="ros","rhk",Company)
No, in EXTRACT-xxx, the
xxx can be anything as long as it's unique within a stanza. In EVAL-xxx, the
xxx must be the field name.
I worked out why mine wasn't working, I had the EVAL-Company in the host::* section, but had the REPORT-Company in the sourcetype stanza and I read that precedence is host first, so my Company field did not exist when it tried to make the substitutions. Fixed that and it worked.
Thanks for all the comments.